CVE-2026-10575 Overview
CVE-2026-10575 is a heap buffer overflow vulnerability in IBM MQ that affects the processing of MQPUT operations containing malformed distribution headers. An authenticated attacker with network access to the queue manager can trigger the overflow by submitting crafted message payloads. Successful exploitation can cause denial of service against the messaging service or, in some scenarios, enable privilege escalation on the affected host. The flaw is classified as [CWE-122] Heap-based Buffer Overflow and impacts both IBM MQ Long Term Support (LTS) and Continuous Delivery (CD) release trains, including version 10.0.0.0.
Critical Impact
An authenticated network attacker can crash the IBM MQ queue manager or potentially escalate privileges by sending a single crafted MQPUT request with a malformed distribution header.
Affected Products
- IBM MQ Long Term Support (LTS) releases
- IBM MQ Continuous Delivery (CD) releases
- IBM MQ 10.0.0.0 (Continuous Delivery)
Discovery Timeline
- 2026-09-18 - CVE-2026-10575 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-10575
Vulnerability Analysis
IBM MQ uses distribution headers (MQDH) to route a single MQPUT message to multiple destination queues within a distribution list. The queue manager parses these headers when it accepts messages from clients or channel agents. A malformed distribution header can cause the parser to write past the bounds of a heap-allocated buffer during message processing.
The attack requires valid credentials to authenticate to the queue manager, but no user interaction. Because IBM MQ queue managers typically run with elevated service privileges, memory corruption in this code path can lead to arbitrary control of process state. The result is either process termination and denial of service or execution in the security context of the mqm service account.
Root Cause
The root cause is missing or incorrect length validation when the queue manager copies fields from an attacker-supplied distribution header into a fixed-size heap buffer. The parser trusts size or count values embedded in the header structure without verifying them against the allocated destination. This is a classic [CWE-122] heap-based buffer overflow pattern.
Attack Vector
Exploitation is performed over the network against an exposed MQ listener, typically TCP port 1414. The attacker authenticates as a valid MQ user, opens a queue that supports distribution lists, and issues an MQPUT or MQPUT1 call with a message that carries a crafted MQDH header containing invalid record counts or offsets. Processing the malformed header triggers the overflow inside the queue manager process.
No public proof-of-concept exploit is available at the time of publication. See the IBM Support Page for vendor-specific technical details and fix pack information.
Detection Methods for CVE-2026-10575
Indicators of Compromise
- Unexpected termination or FDC (First Failure Data Capture) files generated by the queue manager process (amqzxma0, amqrmppa) referencing distribution header parsing.
- Repeated MQPUT failures from a single authenticated principal followed by queue manager restarts.
- Anomalous outbound connections or new child processes spawned by the mqm service account after message ingestion.
Detection Strategies
- Enable and forward IBM MQ error logs (AMQERR01.LOG) and FFST diagnostic output to a central logging pipeline for correlation with authentication events.
- Baseline normal use of distribution lists per application and alert on principals that suddenly begin issuing MQPUT calls with MQDH headers.
- Monitor queue manager process crashes and automatic restarts as a signal of exploitation attempts against this class of parser bug.
Monitoring Recommendations
- Track authentication events on MQ listeners and correlate failed or unusual logins with subsequent queue manager instability.
- Alert on new or unexpected processes launched under the mqm account, which would indicate successful code execution.
- Watch for network scanning or repeated connections to TCP port 1414 from internal hosts that do not normally act as MQ clients.
How to Mitigate CVE-2026-10575
Immediate Actions Required
- Apply the IBM-provided fix pack referenced in the vendor advisory to all affected LTS and CD queue managers.
- Inventory IBM MQ deployments, including embedded and appliance-based instances, and prioritize internet-exposed listeners.
- Rotate credentials for MQ user accounts that authenticate from untrusted network segments.
Patch Information
IBM has published remediation guidance and fix pack details on the IBM Support Page. Administrators should identify their queue manager version and command level, then apply the corresponding LTS or CD fix pack listed in the advisory. Restart the queue manager after patching to load the corrected parsing code.
Workarounds
- Restrict network access to the MQ listener port (1414 by default) using host firewalls or network ACLs so that only trusted application hosts can connect.
- Enforce Channel Authentication Records (CHLAUTH) and Connection Authentication (CONNAUTH) to limit which principals can authenticate and which IP ranges may connect.
- Where feasible, disable or restrict use of distribution lists on queues that do not require them, reducing exposure of the vulnerable code path.
- Run queue managers under a dedicated low-privilege service account and apply operating system hardening to limit the blast radius of a successful exploit.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
